I am still on 1Password 6 because it is the last version with the self-hosted vault.
7 will be the last version to support a local vault - I am using it now.
1password is considering a self-hosted option to store vaults
111–120 of 228 posts
Re: 1password is considering a self-hosted option to store vaults
#112I used 1password for about ten years. Every interaction I had with the developers was pretty hostile. Even if they encouraged self-hosting and version-based upgrading instead of a SaaS, I'd still stick with a competitor. At this point I'm irrationally bothered by the fact that it's a 100+ staff company just to make a product that's no better than it was when they had 10 staff and is now more expensive.
> I used 1password for about ten years. Every interaction I had with the developers was pretty hostile. Even if they encouraged self-hosting and version-based upgrading instead of a SaaS, I'd still stick with a competitor. At this point I'm irrationally bothered by the fact that it's a 100+ staff company just to make a product that's no better than it was when they had 10 staff and is now more expensive.
I have no idea why you're being downvoted for expressing your experience and opinions. So I will just add another data point to corroborate your experience and (probably) be downvoted together.
I've also been a long time user who paid for every upgrade, and every issue I had with them I received a hostile response or a completely dismissive one. Not sure which is worse.
This made me jump ship last year and now I'm a happy bitwarden user.
No, it's not perfect as you can see in others comments around here but at least I don't have the constant nag that their values are misaligned with mine: forcing a subscription model down my throat at almost 4x the amount of money that bitwarden asks with fading support for standalone licenses and local vaults.
Re: 1password is considering a self-hosted option to store vaults
#113Vaults, self-hosting, all these needless complications imo for what should be simple. Just give me a secure deterministic password from a website address + master pass combo.
That's exactly what my project, https://app.srspass.com aims to do.
Even though I have a super redundant NAS setup, I'd really hate to depend on a vault and have it all disappear due to some disaster. With SrsPass, I just remember one password, have a recovery/backup phrase written somewhere that it gives me which adds 128-bit of entropy to each generated password and boom, that's my password manager. Stateless, deterministic, and by using argon2id, PHC winner, on the client side it is doing what most password backends should be, but often aren't doing, which is strong memory-hard password hashing.
Re: 1password is considering a self-hosted option to store vaults
#114Earlier quoted context omitted.
If it's properly encrypted you should be able to publish it on github and still be more secure than entrusting it to a third party.
Publishing your vault of passwords on a public GitHub repository seems like a pretty bad idea, no matter how well you trust the client-side encryption code. I'm no expert on the subject, but I suspect these password managers use a sophisticated mechanism of authentication (for accessing the vault) as well as encrypting of the actual contents of the vault. The effect of this means that Bob's encrypted vault cannot be…
And why do you think that authentication + encryption is going to be more secure than encryption alone? Either way, there's a secret. If you know the secret you can access the data and if you don't you can't. The UI/UX trappings of the mechanism don't change this fundamental dynamic.
What does change the dynamic is if you allow a third party to control the code that you run.
Re: 1password is considering a self-hosted option to store vaults
#115They made the standalone license almost impossible to find and get, forced a subscription on users, and made the password vault storage online for the subscriptions. Now this self-hosting survey comes as a surprise, and it would be of some relief if/when it’s implemented. I do wonder how the licensing and pricing will be handled though. Bitwarden officially allows self-hosting for the personal use tiers, but it seems…
I've used pwsafe[1] for years, maybe over a decade. Multiple platforms supported, although macOS and iOS versions are paid (one time payment, no subscription). Store your vault anywhere you want.
Re: 1password is considering a self-hosted option to store vaults
#116I always assumed that they didn’t have the keys to unlock my vault, so even if something was compromised it is all encrypted with no way for them to access it. What is the advantage of self hosting?
The key word here is assumed. I am not saying they have access, but considering the implications if someone else could access all of my passwords, I would rather not take the risk.
Re: 1password is considering a self-hosted option to store vaults
#117Earlier quoted context omitted.
I'm paying for a Bitwarden subscription because I want to support their product and their vision. But I don't know, time passes and some much needed improvements don't seem to arrive. The most glaring issue (for me, anyway; I fully understand I'm just a sample size of 1!) they have is relying on the pop-up UI of the browser, which I guess is stateless (state is lost when the popup closes, it seems?). The decision of…
Tavis Ormandy (of Google Project Zero) has a pretty convincing post arguing that relying on browser extensions that modify the DOM (which includes [almost?] all password managers) is a bad idea: https://lock.cmpxchg8b.com/passmgrs.html (he recommends using your browser's built-in password manager, which isn't as convenient but is much more secure)
It'd be ideal if browsers offered standard hooks into their password-filling mechanisms. Let the password managers volunteer "I know a password for this site!" and fill it through the browser's standard UI.
Basically, I want the browsers to implement something close to what Apple has for password management on iOS. Ideally go a bit further and expose hooks for creating/saving a new login, too.
Unless they already do this, and nobody has actually taken them up on using it?
Re: 1password is considering a self-hosted option to store vaults
#118I understand that 1Password is a business and it’s their prerogative to make money.
In 2014 I switched to self-hosted password management with 1P and it changed my life. Today, my 1P vaults are a daily, indispensable part of computing. There are thousands of records and my overall security is dramatically higher.
Fast forward a few years and I heard that they had introduced a subscription.
Why?
It’s not their fault: everyone does it. But is this really a subscription service? The applications on my computer and phone have worked smashingly well for years. Is there enough of an ongoing need for development as to require a subscription? I’d rather pay a periodic upgrade fee as maintenance is required.
At the same time, independent and decentralized password management makes sense. I don’t want AmaGooSoft holding my passwords to everything.
In any event, I will continue to use older versions of password management to save on the subscription.
Re: 1password is considering a self-hosted option to store vaults
#119They made the standalone license almost impossible to find and get, forced a subscription on users, and made the password vault storage online for the subscriptions. Now this self-hosting survey comes as a surprise, and it would be of some relief if/when it’s implemented. I do wonder how the licensing and pricing will be handled though. Bitwarden officially allows self-hosting for the personal use tiers, but it seems…
> Is there any password management application out there that makes sharing passwords or password vaults easy but is also free? For members of a relatively well-paid profession earning good wages from creating software, I wonder if the reluctance to support others earning money for quality work isn’t some form of cognitive dissonance. // Pre-emptive “edit” before this comment has replies: Folks post a lot of argument…
With 1Password, the subscription is really expensive, and I’m afraid that the bloat the company is stuffing into the product is weakening the security. Frankly, they make too much money.
I’ve found enough bugs in the Mac product that I assume there are security issues I’m not aware of.
Re: 1password is considering a self-hosted option to store vaults
#120Vaults, self-hosting, all these needless complications imo for what should be simple. Just give me a secure deterministic password from a website address + master pass combo. That's exactly what my project, https://app.srspass.com aims to do. Even though I have a super redundant NAS setup, I'd really hate to depend on a vault and have it all disappear due to some disaster. With SrsPass, I just remember one password,…
I'm sorry, maybe I'm just dense, but how can the output of your generator be deterministic if you add entropy?
Further, if it's deterministic, how is this different from just running your password through a hashing algorithm and then using the hash as your password? The only extra information an attacker has to figure out is what hashing algorithm you used and he can generate all of your passwords from your memorized one.
Right? That or I don't understand what you are describing.